Wrong IP address when pinged from another machine?

Question

I recently got a new computer at work and I'm having trouble connecting to it from other computers. I can access other computers from it, just not the other way around. I checked all the usual suspects: Firewall, AV, etc. Nothing was out of the ordinary.

After troubleshooting for a while I stumbled upon an unusual IP problem. I pinged my computer by name from another machine and it resolved to a different IP address than what the computer reported using IPConfig. I dug further using arp and found that the MAC address associated with the IP address being pinged didn't match the MAC address of any of the network devices on my computer (all but one were disabled anyway). I asked a coworker to ping my machine to confirm my findings. Same result.

This leads me to think there is another computer with the same machine name as mine somewhere on the network. My former computer had the same machine name but is now sitting, turned off, on an IT department desk awaiting whatever fate they have in store for it. I never had this problem with it. Anyway from my own past experiences I would have expected any machines with the same name to be annoying their users with messages about name clashes.

I brought up my problem with IT. They recited some incantations over the domain controller, DHCP and DNS servers then told me to flush my dns cache and renew my IP address on the machines I was working with but it was to no avail. At this point I'm just waiting on them to look into the matter further.

I do have several applications that could potentially muck with the network devices. VMWare, VirtualBox and a VPN app, all of which are dormant at the moment. I had all the same apps on my old machine and never experienced this kind of problem so I don't think its any of them.

Is there anything else I can do to track down the source of this problem?

Update

---

I took simkill's advice and tried to force a DNS update. After waiting 15 minutes I flushed the DNS cache on the machines and tried pinging again. Something I failed to mention before... the pings do not time out as you would expect if they were resolving to an offline host. I am getting a response from the mystery machine. Anyway, the ping gave me the same results as before. I decided to try a tracert (which attempts to resolve an IP address to a host name) using the IP addresses of both machines. They both resolve to the same host name.

Solution

This is a DNS issue. What your IT department said was true. The name of your old machine has been cached by the other machines on the network. In other words, previously the other machines went to your DNS server and asked what the IP address was of the machine matching that name. The server responded with what was the correct IP at the time, which the PC stored for future reference. This local cached copy is usually discarded after a certain period of time. You can force the purge of the cached information by doing ipconfig /flushdns on the machine you are pinging from using cmd.

If that doesn't work, then the DNS record probably hasn't been updated on the dns server. You can do ipconfig /registerdns from your new machine to try and force the update. Wait 15 minutes, go to the old machines that have the incorrect IP logged, flush the dns records again and try to ping again.

If this doesn't work, blow your IT teams mind by asking them this: 'Hi guys! Please can you check the A record for (machinename) on your DNS server? I have a suspicion it's (oldIP) rather than (newIP). If it's not, I don't think dynamic DNS updates are working properly from your DHCP server. Can you check it out and get back to me?'

UPDATE

@Kenneth In response to your update, it's entirely possible there are two A records for the same computer name in DNS. Whilst the record for your old machine may still be pointing to your old machines name, the DHCP IP address for the old machine could have been assigned to someone else. In which case, the name will resolve to the wrong PC. What you can do, is type nslookup in cmd then type the IP of the machine that is responding when it shouldn't be. This should check the reverse DNS entries instead of the A records, and should give you the real name of the machine.

In either case, you can ask your IT team to hack up DNS manually to resolve the issue. It's a really, really short and easy job. They shouldn't take any longer than 5 minutes to resolve it.

Comments

[Admin]

By "name" do you mean hostname or FQDN (cochran-pc.cts-america-.com)?

[Admin]

I've tried pinging both with the same results.

[Admin]

@Kenneth In response to your update, it's entirely possible there are two A records for the same computer name in DNS. Whilst the record for your old machine may still be pointing to your old machines name, the DHCP IP address for the old machine could have been assigned to someone else. In which case, the name will resolve to the wrong PC. What you can do, is type nslookup in cmd then type the IP of the machine that is responding when it shouldn't be. This should check the reverse DNS entries instead of the A records, and should give you the real name of the machine.

[Admin]

The plot thickens. I tried nslookup on both ip addresses. DNS server couldn't find records for either, responding with "Non-existent domain".

[rtf]

Updating DNS via DHCP in an AD environment is a vomitous decision by the way; it wouldn't surprise me if that's what's responsible for the mess.

[Kenneth Cochran]

See my update. tracert is resolving both IP addresses to the same host name.

[Kenneth Cochran]

In the end it looks like a configuration problem with the DHCP and DNS servers. The admin didn't give me any specifics and I didn't ask but it sure sounds like dynamic updates aren't configured properly, if at all. The admin's solution was to rename my machine to something else and rejoin it to the domain.